Keynote: Bringing Greater Trust and Security by Design to the Open Source Ecosys...
summary
OpenSSF lays out concrete programs: a 150 million dollar mobilization plan over two years with ten themes, $30M already pledged, and specific investments like $300k to fund a Node.js security team. Projects include adoption of sigstore and SLSA level four attestations (Kubernetes already using SLSA), the Harvard census dependency analysis, and Alpha Omega scanning and funding for 10,000 critical repos. Cites Log4Shell and SolarWinds as triggers and targets rapid code audits, incident response, and SBOM rollout.
AI-written summary · about
chapters (9)
- 0:00Start
- 7:00Securing Critical Projects
- 7:24Harvard Census
- 8:00Securing Software Repositories
- 8:51The Gnu Tool Chain Infrastructure
- 9:37Sig Store
- 10:15Alpha Omega
- 19:38How Do We Develop an Incident Response Team That Can Work with Open Source Projects
- 20:10Fund More Code Audits
related talks
22mKeynote: Securing the Open Source Ecosystem
44mSecuring Open Source Software - End-to-End, at Massive Scale, Together
04mKeynote: A Secure Supply Chain Vision
11mKeynote: Securing Open Source
14mKeynote: All Your Base Are Belong to Us
15mKeynote: Government's Continuing Path Contributing Towards a Secure Open Source Ecosystem
57mFrontiers in Securing the Open Source Ecosystem
08mKeynote: Security of the Open Source Supply Chain, a Call to Action